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ABSTRACT 



A method and system for fiUering and acting upon data are 
provided. The specific identity, behavior and relationship 
between the various components that make up the system 
are not fixed at compile time. Rather, flexibility is main- 
tained by establishing the identity, behavior and relation- 
ships based on configuration data at run time. At run time, 
various source, filter and action modules that are specified in 
configuration data are loaded into dynamic memory and 
initialized. The publisher-subscriber relationships are then 
established between the loaded modules based on said 
configuration data. A user interface is provided which allows 
a user to specify changes to the publisher-subscriber rela- 
tionships between the components, or to the initialization 
arguments of the components. The various components of 
the system may be implemented as objects that are instances 
of JAVA classes. 

36 Claims, 3 Drawing Sheets 
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nvx] A ivyiir A f I V PONFIOURABLE Because the filters, actioDS and source modules and connec- 

FILTERED "l^^^iCH P«uiiri^/^iiwi operation of the filtering systems in response to changes. 

Changes that may require behavioral or connection changes 
FIELD OF THE INVENTION 5 in filtering systems may include, for example, changes in (1) 

which information is considered key information and (2) the 
The present invention relates to network management number and type of sources supplying the information and 
systems, and more particularly, to a method and apparatus number and type of actions to be triggered upon 

for identifying important infonnation among the total infor- receipt of information that is considered key. 
mation collected by network management systems. ^^^^ foregoing, it is clearly desirable to provide 

„ ^^™^vT a mechanism for delecting and acting upon key information 

BACKGROUND OF TOE INVEmiON Lpp^e^by one or more purees. It is further desirable to 

Network management systems often have access to enor- provide a mechanism that is flexible enough to be adapted to 
mous amounts of data about the networks that they manage. ihe changing needs and configurations of the system m 
Such data includes, for example, "syslog" messages gener- 15 which it is employed. 

ated by routers, and Management Information Base van- SUMMARY OF TOE INVENTION 

ables ("MIB variables") received in response to polling the 

various devices on the networks. A method and system for filtering and acting upon data are 

TVpically, this data is stored in the form of log files. provided. The specific identity, behavior and relationship 
Because of the volume of data available to network man- 20 between the various components that make up the system 
feementsvs eL i is relatively easy for impom are not fixed at compile time. Rather, flexibihty is main- 

nCiorrkey iofoination") to go undetected, effec- tained by establishing the identity, behavior aad relation- 
lively lost deep inside a log file. For example, among the ships based on configuration data at run lime, 
"syslog" messages generated by a router, there may be a According to one aspect of the invention, the conh^ra- 
single "configuration change" message hidden among thou- 25 tjo,, jata specifies a set of source modules, a set ot hlter 
sands of relatively unimportant "link-up" and "link-down" modules, a set of action modules, and publisher-subscnber 
messages. Detection of such a configuration change message relationships between the source modules, filter modules, 
may be the key to determining why a particular section of and action modules. At run time, the various modules 
the network ceased to function properly. specified in the configuration data are loaded into dynamic 

TTie volume of collected data is such that it is not practical ^0 memory and initialized. The publi.sher-subscnber relat.on- 
for networradmirttrators to manually sift through the log ships are then esUblished between the loaded modu es bas d 
files on a reaUime basis to uncover key information. on the configuration data. The source modules then begm 
Consequently, attempts have been made to automate the execution. ,i,,u,h»vior 
discovery of key information. One such attempt involves the According to another aspect of the mvention the behavior 
ad-hoc creation of shell or PERL scripts. Such sCTipts may of the various components is determined by arguments 
be coded to read the log files searching for data that has passed to the components when they are initiaU2»d. A user 
certain characteristics. If data that satisfies the programmed interface is provided which allows a user to specify changes 
criteria of a saipt is detected by the script, the script to the publisher-subscriber relationships between the 
performs some predefined action. ^„ components, or to the initiaUzation arguments of the com- 

S liiti to usTof reUilvel, compta b, Ih con,po««,» .r« QtaDg.d. I. re.pon« lo mer 

Ersid^rki^rfLtrLr.™ » L » .^u .«< oto, «» .» 

at time Tl. Similarly, an analytical tool executed at time TIO executing. 

may discover at time T20 the key information received at gj^j^p DESCRIPTION OF THE DRAWINGS 
'-rr approach to detecting key information . to 

rr^^r^if ^^0. 1 is a block diagram illu^rating a computer system 

docket a og file or abg file reader. Programs that perform 50 that may be used to mtplemen. the invention; 

such real-time analysis are referred to as filtering systems. FIG. 2 is a flow chart illustrating steps for eslabkshing 

OneprlemwitLypicalfilteringsystemsisthatthey are subscriptions baf on oonflgura^^^^ data according to an 

infle^ble with respect to the type of key information they embodiment of the invention, and 

de!"t anrtL dau with which they work. For FIG. 3 is a block diagram lUustrating an exemplar, 

example a lypLl Qllering system is delivered precompiled 65 message dispatcher system accordmg to an embodunenl of 

wirfe^^cSns and^source modules, as well as the the invention and a user interface for manipulating the 

connections between the various modules, already in place. dispatcher system. 
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DETAILED DESCRIPTION OF THE 
PREFERRED EMBODIMENT 

A method and apparatus for filtering and acting upon data 
is described. In the following description, for the purposes of ^ 
explanation, numerous specific details are set forth in order 
to provide a thorough understanding of the present inven- 
tion. It will be apparent, however, to one skilled in the art 
that the present invention may be practiced without these 
specific details. In other instances, well-known structures 
and devices are shown in block diagram form in order to 
avoid unnecessarily obscuring the present invention. 

Hardware Overview 
FIG. 1 is a block diagram that illustrates a computer 
system 100 upon which an embodiment of the invention 
may be implemented. Computer system 100 includes a bus 
102 or other communication mechanism for communicating 
information, and a processor 104 coupled with bus 102 for 
processing information. Computer system 100 also includes 
a main memory 106, such as a random access memory 
(RAM) or other dynamic storage device, coupled to bus 102 
for storing information and instructions to be executed by 
processor 104. Main memory 106 also may be used for 
storing temporary variables or other intermediate informa- ^5 
lion during execution of instructions to be executed by 
processor 104. Computer system 100 further includes a read 
only memory (ROM) 108 or other static storage device 
coupled to bus 102 for storing static information and instruc- 
tions for processor 104, A storage device 110, such as a 
magnetic disk or optical disk, is provided and coupled to bus 
102 for storing information and instructions. 

Computer system 100 may be coupled via bus 102 to a 
display 112, such as a cathode ray tube (CRT), for displaying 
information to a computer user. An input device 114, includ- 35 
ing alphanumeric and other keys, is coupled to bus 102 for 
communicating information and command selections to 
processor 104. Another type of user input device is cursor 
control 116, such as a mouse, a trackball, or cursor direction 
keys for communicating direction information and com- 40 
mand selections to processor 104 and for controlling cursor 
movement on display 112. Iliis input device typically has 
two degrees of freedom in two axes, a first axis (e.g., x) and 
a second axis (e.g., y), that allows the device to specify 
positions in a plane, 45 

'VhG invention is related to the use of computer system 100 
for filtering, dispatching and acting upon information. 
According to one embodiment of the invention, message 
filtering and dispatching is performed by computer system 
100 in response to processor 104 executing one or more 50 
sequences of one or more instructions contained in main 
memory 106. Such instructions may be read into main 
memory 106 from another computer-readable medium, such 
as storage device 110. Execution of the sequences of instruc- 
tions contained in main memory 106 causes processor 104 55 
to perform the process steps described herein. In alternative 
embodiments, hard-wired circuitry may be used in place of 
or in combination with software instructions to implement 
the invention, llius, embodiments of the invention are not 
limited to any specific combination of hardware circuitry 60 
and software. 

The term "computer-readable medium" as used herein 
refers to any medium that participates in providing instruc- 
tions to processor 104 for execution. Such a medium may 
take many forms, including but not limited to, non-volatile 65 
media, volatile media, and transmission media. Non-volatile 
media includes, for example, optical or magnetic disks, such 



as storage device 110. Volatile media includes dynamic 
memory, such as main memory 106. Transmission media 
includes coaxial cables, copper wire and fiber optics, includ- 
ing the wires that comprise bus 102. Transmission media can 
also take the form of acoustic or light waves, such as those 
generated during radio-wave and infra-red data communi- 
cations. 

Common forms of computer-readable media include, for 
example, a floppy disk, a flexible disk, hard disk, magnetic 
tape, or any other magnetic medium, a CD-ROM, any other 
optical medium, punchcards, papertape, any other physical 
medium with patterns of holes, a RAM, a PROM, and 
EPROM, a FLASH-EPROM, any other memory chip or 
cartridge, a carrier wave as described hereinafter, or any 
other medium from which a computer can read. 

Various forms of computer readable media may be 
involved in carrying one or more sequences of one or more 
instructions to processor 104 for execution. For example, the 
instructions may initially be carried on a magnetic disk of a 
remote computer. ITie remote computer can load the instruc- 
tions into its dynamic memory and send the instructions over 
a telephone line using a modem. A modem local to computer 
system 100 can receive the data on the telephone line and 
use an infra-red transmitter to convert the data to an infra-red 
signal. An infra-red detector coupled to bus 102 can receive 
the data carried in the infra-red signal and place the data on 
bus 102. Bus 102 carries the data to main memory 106, from 
which processor 104 retrieves and executes the instructions. 
The instructions received by main memory 106 may option- 
ally be stored on storage device 110 either before or after 
execution by processor 104. 

Computer system 100 also includes a communication 
interface 118 coupled to bus 102. Communication interface 
118 provides a two-way data communication coupling to a 
network link 120 that is connected to a local network 122. 
For example, communication interface 118 may be an inte- 
grated services digital network (ISDN) card or a modem to 
provide a data communication connection to a correspond- 
ing type of telephone line. As another example, communi- 
cation interface 118 may be a local area network (LAN) card 
to provide a data communication connection to a compatible 
LAN. Wireless links may also be implemented. In any such 
implementation, communication interface 118 sends and 
receives electrical, electromagnetic or optical signals that 
carry digital data streams representing various types of 
information. 

Network link 120 typically provides data communication 
through one or more networks to other data devices. For 
example, network link 120 may provide a connection 
through local network 122 to a host computer 124 or to data 
equipment operated by an Internet Service Provider (ISP) 
126. ISP 126 in turn provides data communication services 
through the world wide packet data communication network 
now commonly referred to as the "Internet" 128. Local 
network 122 and Internet 128 both use electrical, electro- 
magnetic or optical signals that carry digital data streams. 
The signals through the various networks and the signals on 
network link 120 and through communication interface 118, 
which carry the digital data to and from computer system 
100, are exemplary forms of carrier waves transporting the 
information. 

Computer system 100 can send messages and receive 
data, including program code, through the network(s), net- 
work link 120 and communication interface 118. In the 
Internet example, a server 130 might transmit a requested 
code for an apphcation program through Internet 128, ISP 
126, local network 122 and communication interface 118. 
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•n,e received code may be executed by processor 104 as The action objects specified io the configuration file are 

i, ?reS and/or S in storage device 110. or other then loaded and initialized. After the action objects are 

l-voU ufstoraS torTa.er exertion. In this manner. loaded and initiaUzed. the dispatch system coordmator sub- 

"miJ system 100 may obtain application code in the scribes the action objects to the filter objects as spectfled m 
form of a carrier wave. 5 the configuration file. 

After the source, filler and action objects have been 

Functional Overview loaded, initialized, and all of the appropriate subscriptions 

. f have been made, the dispatch system coordinator launches 

A dispatcher system is provided m which components ol ^^^^^ causing each source object to begin execution 
the system communicate with each other based %o in its own thread. 

subscriber/publisher model. In a ^"^scnber/pubhsher m^^^^ According to one embodiment of the invention, the dis- 

modules U.at p^duce messagM-p^^^^^^^ pa^h s^em coordinator communicates, in a separate 

"subscnber list" of modules (' subscnbers ) that are in er- patc" management process or user interface to start, 

ule may be only a publisher, only a subscriber, or both a ™^ fj^^^ parameter 

publisher and a subscnber. values while the dispatch system is in operation. 

According lo one embodiment of the mvention, a dis- 20 

patcher system is provided in which the tasks associated Configuration Data 

with responding to key information are divided up among coordinator is 

modules referred to herem as source objects, filter objects ^^^g^™ establish subscriptions 

and action objects. between the various components of a dispatch system based 

Source objects are pubUshcrs that receive or retrieve data 25 configuration data. According to one embodiment of the 

from a source and transmit the data to a set of subscribers. inyen^on the configuration data, which may be stored in 

According to one embodiment, each source object mamtams ^^^^ ^^^^^ idemifies sources by the keyword SRC, 

a list of the subscribers to which it must send the data that ^^^^^^ keyword FLT, and actions by the keyword ACT. 

is received from the source associated with the source addition, configuration data specifies subscriptions 
object. ^0 between components based on the rules: (1) filters subscribe 

Filter objects are typically both publishers and subscrib- source that most immediately precedes them in the 

ere. Filter objects receive messages from publishers and configuration data, and (2) actions subscribe to the filter that 

provide filtering criteria that decides whether the message ^^^^ immediately precedes them in the configuration data, 

should be dispatched to its subscribers. Filters may also ^ exemplary set of configuration data that uses this 
transform the message if so designed. The main function of 35 ^^^^^^ 

a filter is to decide whether the message embodies key LogReader/tmp/syslo^info 

information which the user is interested in. SimpleTextFilter deny ISDN 

Action objects are typically subscribers that receive mes- ShellAction log.sh no_isdn.txt 

sages from the publishers with which they are registered. p^^^ NullFilter 

Action objects respond to the messages by performing NativeSyslog 

actions dictated by their logic. The type of action will vary ShellAction log.sh my_syslog.txt 

from action object to action object. For example, one class SocketReader 9009 

of action object may execute a script generating an alert to ReverseFilter 

a network management station (NMS) while another class of ShellAction echo 

action object may trigger an update to a database. ShellAction log.sh reverse.txt 

According to one embodiment of the invention, the spe- response to this configuration data, the dispatch system 

cific components and relationship between components of a coordinator would load and initialize two source objects 

dispatch system are established by a coordinator process, (LogReader and SocketReader), three filter objects 

referred to herein as a dispatch system coordinator, based on (SimpleTextFilter, NuUFilter and ReverseFilter) and five 

information contained in a configuration file. action objects (NativeSyslog and four instances of 

^ , ShellAction). 

Dispatch System Coordinator ^^^^ subscription rules specified above, the 

A dispatch system coordinator is a module that reads and dispatch system coordinator would subscribe the Simple- 

narses a configuration file and sets up a dispatcher system 55 TextFilter to the LogReader, and the first instance ot Shel- 

bascd on the configuration file. The configuration file indi- lAction to the SimpleTextFilter. The NullFilter would be 

cates the source objects, filter objects, and action objects that subscribed to the LogReader, and the NativeSyslog and 

are to be used in a particular dispatch system, and the second iostance of ShellAction would be subscnbed to the 

relationships between the source, filter and action objects. NullFilter. The ReverseFilter would be subscnbed to the 

After reading and parsing the configuration file, the dis- 60 Sc^ketReader, and the third and fourth mstances of Shel- 

patTsy tem Lrdin'ator loads and initiaHzes the sources lAction would be subscnbed to the R-ereeFi^^^^ 

fdentified in the configuration file. The dispatch system M illustrated m the above example, the configuration dm 

foordin^^^^^ and initializes the fillers identified in may specify parameter values with which various modules 

rSuration file. After the sources and the filters have are to be initialized. The parameter values used to initialize 

leen'oad^ and initialized, the dispatch system coordinator 65 a particular module can significantly 7-^^he behavior of 

subscribes the filter objects to the source objects as specified the module. For example, the first instance of the ShellAc- 

n the fi e. tion action object is followed by the parameter values log.sh 
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no_isda..x,. When ini.iaUzed wijb .hese parameter va.. Ss^o'^rdtSv^^^^^^^^^^ 

the ShellAclion action object wUl respond to messages by .s conhgured to P ^.^^ ^ ^^.^^^^^ 

executing a shell program named "log.sh that wtll store .is Pj^g^^ ^col&garcd to read and publish 

results in a text file named no_isdn.txt. If different param- ^^^^ ^^^^ ^ ^^^^ ^ ^ 61^ 304 

eters are suppUed, the ShellAcdon object may r«pond to 5 ^^^^^ .^^^^^^ ^ p,^^^^,^ g„„ ^,bjects 

messages by executing a shell scnpt that does someimng j^g'jjQ ^j^^ 314^ jnd a plurality of action objects 316, 

completely different than the log.sh shell scnpt. aig'and 320 FiUer object 308 and filter object 310 subscnbe 

. ^ „ . to messages published by socket reader 302. FUter object 

Configuration Data Processing subscribes to messages published by filler object 310. 

According to one embodiment of the invention, the dis- '° FUter object 314 subscribes to messages published by log 

lishing the publisher/subscriber relationships between the P^^^J^^^-^^Jp^^^^^^^^^^ and 314. 
components. ^^^^ dispatch system coordinator has loaded and 
FIG. 2 is a flow chart illustrating the operation of the . . ^j^^ ^^^^^^3 objects in system 300, the dispatcher 
dispatch system coordinator during the subscnpUon phase. ^ coordinator launches socket reader 302 and log 
At step 200. the disT)atch system coordinator starts with an ^^^^^^ ^^^^.^^ ^^^^ ^^^^ execution in their own 
empty set of unsubscribed actions and an empty set oi ^^^^^^ remaining components of system 300 are not 
unsubscribed filters. Beginning at the end of^the conngura- j-Q^jjed since they only execute upon being invoked by an 
tion data, the dispatch system coordinator begms reading ^^^^ ^ executing. For example, assume that socket 
upward (Step 202), adding action objects encountered to the J^^^ ^^^^.^^^ ^^^^ ^^^^ ^^^^ ^^^^^ ^^^^ it monitor- 
unsubscribed action set (Steps 204 and 206). This continues ^^^^^^ ^^^^^^ publishes this message by invoking 
until a filter object is encountered. 25 ^ jj^'^thod on each of its subscribers, and passing the message 

When a filter object is encountered, the members of the argument to the method, 
unsubscribed action set are subscribed to the filter object and purposes of explanation, the method of a sub- 
removed from the unsubscribed action set. The filter object ^^^^ invoked by a publisher to pass a message to 
is added to the unsubscribed filter set (Steps 208 and 210). subscriber shaU be referred to as the "update" method. 
The loop defined by steps 202, 204, 206, 208 and 210 is 30 ^^^^^^^ example, socket reader 302 would - 
repeated until a source object is encountered. invoU the update method of filter object 308. The update 
When a source object is encountered, the members of the method of filter object 308 would then execute. The update 
unsubscribed filter set are subscribed to the source object ^^^^^^ ^^^j. object 308 contains logic that determines 
and removed from the unsubscribed filter set (Step 212). The ^^^^^ ^^-^^^ 398 responds to the message. For the 
entire process is then repeated until the configuration data 35 p^^Q^^s explanation, h shall be assumed that the logic of 
has been completely processed (Step 214). gugr object 308 dictates that filter object 308 take no action 

on the particular message. This may occur, for example it 

Alternative Configuration Formats ^j^^^ ^^.^^^ ^ programmed to filter out the particular 

m configuration data format described above is for type of message that was received from socket read^^^^^^^^ 

iliwe PurX^ only. The present invention is not Execution of the thread associated with socket reader 302 

ir^ ^^^t^^ any p^U^^^^^^^^ data format, m would then return from filter object 308 to socket reader 302 

dLn^d' a^vl works'well for three-level tree^ Socket reader 302 would t^^^^^^^^^^^ t^^^^^^^^^^ 

.=t,aneridisDatch6rsvstems(i.e. dispatcher systems in which subscriber m its subscription list (h Iter obJ«ci J^"; "y 

earcoSnen. hasCy o parent and where there is only invoking the update method of filter object 310. TTie upda e 

Te flZ bXeen any Lrce and action object). However, method of filter object 310 would then execute. The update 

r^rsS^Se^d^rm. may be rc.Ld for other ^^^^^^Z 

'tr:s:r!^^^ .ay — ^ ^^^^^ 

take the form of pubUsher/subscriber tuples. Based on this .^^scribels. 

format, the configuration data: ^.^^^^ ^^.^^ ^^^^^ ^^^^^ f^^i 

(SRC si, FLT fl) subscriber in its subscription list (action object 318) by 

(FLT fl, ACT al) invoking the update method of action object 318. The update 

fFLT fl, FLT f2) „ method of action object 318 would then execute. The update 

rpi T n ACT a2^ method of action object 318 contains logic that determmes 

I2 ubtrib^ tTfil e' Q mttal da?^^^^^ for IZn object 3% causes a shell script to generate a rn«sage 

fubth'Sb^ab^r relationships is Irepresented as a to another network management subsystem to alert the 

directed acyclic graph to represent the publisher/ operator ^ ^ ^^^^^^ 

subscriber tuples. exertion "mms to action object 318. When the update 

Exemplary Dispatchmg System method of action object 318 completes, thread execution 

M.m.g » FIG. 3, 1. 1. . ..Ls,™ i"~ " "XXim".""'!"" "» » "» "» 
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J. .u„^„f fiiiprnhiprim Theuodale currently in effect for filter object 314. The user may then 

fiUef: S: Sale revise L displayed paratneter values to specify a change 

me hod of filler c£t 312 contains logic that determines that should be made .n the behavior of filter object 314. lie 
method ot Wier Object Ji^ co 8 ^^^^ ^^^.^ g,,^^ „^ parameters are syn- 

u^o^s f^Sn't^ logic of S chroni^ed to P-nt pa^mete. from changing wh.le the 

flllTr object 312 dictates that no action should be taken. filter or acUon logic is bemg mvoked. 

Thread execution then returns to filter object 310. Similarly, a user may create an atrow, delete an arrow, or 

^ u' • . fii,., «h;,r. iin <;ent the messaee to all change the source or destination of an arrow to specity a 

Java-Based Components action object 320. In response to this user input, acUon 

object 320 is removed from the subscriber list of filter object 
As mentioned above the 7"'?,"^..^^°,^^^^^^^ 35 314, and action object 318 is inserted into the subscriber list 

dispatch system are loaded and mitialized by the dispatch » ^ J 

by an mterpreier generally ici^i ^^^^^^ ^^^^^^ configuration. Thus, m an embodiment 

, . • u , ^5 where the dispatch system coordinator operates according to 

Specifically, when the currently-execu Ung byte code ^^^^^J .^^^^^^^^^^ ^ jj^p^,^h ^y^,^ 

invokes an object in a clas.s that has not yet been loaded a j;^^,^^ ^^„^ ^^^^ addSubscriber method of a filter object 

routine referred to as the JAVA class oader ^^J^hes for th^^ addSubscriber method of a source 

class file of the class. Typically, the JAVA class loader will ' V . 

search for the class file in locations identified in a ^arcb 3^ ""^^ ^' J^^;,^^ removeSubscriber methods may 
SLT:c;r::rseXlu = oS tf .^'^'^^rZ dispatcher system is execiiting in 

arge daS^no^^^^^^ at the first location in the search response to user i'^:rt:\LZ^\^li X 
7,fh If the tarcet class file is not found at any locations in patcher system configuration. For examp e a user may 

restrictions are met. coordinator passes an argument that iden- 

The present invention uses JAVA s f ^fen^ed loadmg ot ^ / j„ invocations, si removes 

class files to increase the flexibility o the fll<«™g;3^^^. fl fmmTts subscribedist and s2 adds fl to its subscriber list. 

Specifically, as long as a class bas not already been loaded subsequent messages published by si wiU not 

by the virtual machine, a class file for a particular class may Consequently q J^^V^^ .^^ ^ 

be modified or even replaced with a diflirent class file for be addSubscriber and removeSubscriber 

the same class. Such changes, which when executed may 45 be ^ 3 subscriber from 

significantly affect the functioaality of the JAVA program, ^«*odyre synchron ^^p^ ^ ^ ^.^^ 

can be performed while the JAVA program is executmg. invoked 

Runtime Configuration Modification ^^^^^.^ Publisher Class 

According to one embodirnent of ±e 50 .^.^ ,,^ „yishers consistently implement the basic 

separate from the threads running the sources. Such con- 5s Ushc«^ daLes of the generic publisher dass, thus 

may be ptemed with'the operating pLmeter values the subscriber list of the publisher object. 
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The send method of a pubUsher causes a message to be 
sent to all subscribers listed on the subscriber list of a 
publisher. This may be accomplished, for example, by 
calhDg the update method of each object thai belongs to the 
subscriber list of the publisher. 

Runtime Behavior Modification 
According to an embodiment of the invention, the behav- 
ior of the various modules in the dispatcher system varies 
based on the values of the arguments with which the 
modules are iniUalized. For example, if the action object 
ShellAction is initialized with the arguments "log.sh 
reverse.txi", then the ShellAction object triggers the execu- 
tion of the shell script "log.sh" upon receiving a message, 
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example, socket reader 302 may be configured to receive the 
"syslog" messages generated by a router, and filter object 
308 may be configured to filter out all messages but "con- 
figuration change" messages. Action object 316 may be 
configured to send alert messages to the network admmis- 
trator in response to each configuration change message, or 
to log all configuration change messages to a special 
"debugging" log file. 

Over time, the network administrator may become more 
or less selective in the types of data that should qualify as 
"key information". Using the techniques described above, 
the network administrator dynamically reconfigures the 
appropriate filter objects by re-initializing the objects with 
different argument values that establish new filtermg criteria. 



lion of the shell script "log.sh" upon receiving a menage 5 j^n objects with different 

and the sheU script "log.sh" stores tls output m he file ^ra^a ')^^ by re m ^g^^^^ administrator may cause 
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"reverse.txt". On the other hand, if the same ShellAction 
object is initialized with the argument "olher.sh", then the 
ShellAction object would trigger the execution of the shell 
script "other.sh" upon receiving a message. The shell script 
"other.sh" may do something completely dififerent than the 
shell script "log.sh". 

To facilitate amfiguralion changes, objects must imple- 
ment the method "initialize". When invoked on an object 
this method receives arguments that affect the behavior of 
the object. According to one embodiment, the initialize 
method of objects is called by the dispatch system coordi- 
nator based on information retrieved from the configuration 
data to establish the initial behavior of the objects at the time 
they are loaded into memory. 30 

The initialize method may also be called in response to 
user input that specifies a change in the behavior of an object 
within the dispatcher system after the dispatcher system is 
executing. For example, a user may specify that a filter fl 
that is currently filtering out all messages except those 35 
originated at a particular Internet Protocol ("IF') address be 
changed to filter out all messages except those origmated at 
a different IP address. In response to this user mput, the 
dispatch system coordinator invokes the initialize method of 
filter fl with arguments that specify the new IP address. 

As described above, a generic pubUsher class may be used 
to establish a common interface for functions performed by 
all object classes that are publishers. According to one 
embodiment of the invention, the inheritance feature ot 
object-oriented programming languages, such as JAVA, is 45 
used to establish common interfaces for functions shared by 
all members of other categories of objects as well. For 
example, a "loadable_object" class may be defined to 
include an "initialize" method, and all loadable objects 
(including source objects, filter objects and action objects) 50 
may be created as subclasses of the "loadable_object" class. 

Network Management 
According to an embodiment of the invention, a dispatch- 
ing system that uses the techniques described herein is used 
in a network management environment to sift through the 
enormous amounts of data a network management system 
receives about the network it manages. For example, socket 
reader 302 may be configured to receive messages generated 
by routers and/or MIB variables received from the various 
devices on the networks. Similariy, log reader 306 may be 
configured to read from log files that store such information. 

In such a configuration, filters 308, 310, 312 and 314 may 
be configured to filter out aU data except for data that 
qualifies as "key information", 'llie initialization parameters 
currently in 6D:ect for each filter determines which data 
qualifies as key information with respect to that filter. For 



argument* values, the network administrator may cause 
more, fewer, or different actions to be taken in response to 
detecting key information. 

A method and system for filtering and acting upon data are 
provided- llie specific identity, behavior and relationship 
between the various components that make up the system 
are not fixed at compile time. Rather, flexibility is raam- 
tained by establishing the identity, behavior and relation- 
ships based on configuration data at run time. At run time, 
various source, filter and action modules that are specified in 
configuration data are loaded into dynamic memory and 
initiaUzed. The publisher-subscriber relationships are then 
established between the loaded modules based on said 
configuration data. Auser interface is provided which allows 
a user to specify changes to the publisher-subscnber rela- 
tionships between the components, or to the initializaUon 
arguments of the components. The various components of 
the system may be implemented as objects that are instances 
of JAVA classes. 

In the foregoing specification, the invention has been 
described with reference to specific embodiments thereof. It 
will, however, be evident that various modifications and 
changes may be made thereto without departing from the 
broader spirit and scope of the invention. The specificaUon 
and drawings are, accordingly, to be regarded in an lUus- 
trative rather than a restrictive sense. 

What is claimed is: ... 
1. A method for filtering data, the method composing the 
steps of: 

reading configuration data that specifies publisher- 
subscriber relationships between source modules in a 
set of source modules, filter modules in a set of filter 
modules, and action modules in a set of action modules; 
wherein source modules in said set of source modules are 
software modules configured to obtain data from a 
source and transmit the data in messages to a set of 
subscribers; 

wherein the set of subscribers to which each source 
module transmits messages is determined by informa- 
tion received by said source module while said source 
module is loaded into dynamic memory and not deter- 
mined by code in said source module; 
wherein filler modules in said set of filter modules are 
software modules configured to receive messages and 
provide filtering criteria that decides whether the mes- 
sages should be dispatched to a set of subscribers; 
wherein the set of subscribers to which each filter module 
dispatches messages is determined by information 
received by said filter module while said filter module 
is loaded in dynamic memory and not determined by 
code in said filler module; 
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wherein aclioo modules in said set of action modules are 
software modules configured to respond to messages by 
performing actions; 

creating a set of loaded modules by loading, into dynamic 
memory, modules that belong to said set of source 
modules, said set of filter modules and said set of action 
modules; 

initializing said set of loaded modules; 

establishing said publisher-subscriber relationships 
between said set of loaded modules based on said 
configuration data; 

wherein the step of establishing publisher-subscriber rela- 
tionships includes sending information, based on said 
configuration data, to each source module in said set of 35 
loaded modules to indicate to said source module the 
set of subscribers to which said source module is to 
transmit messages; and 

sending information, based on said configuration data, to 
each filter module in said set of loaded modules to 20 
indicate to said filter module the set of substribers to 
which said filler module is to dispatch messages. 

2. The method of claim 1 wherein: 

said set of loaded modules includes a first source module 
and a first filter module; 

said step of establishing said publisher-subscriber rela- 
tionships includes causing said first source module to 
include said first filter module in a subscriber list 
maintained for said first source module; 

when executing, said first source module receives data 
from one or more sources; and 

upon receiving data from said one or more sources, said 
first source module sends a message to all modules 
listed in said subscriber list maintained for said first 35 
source module. 

3. ^rhe method of claim 2 wherein: 

said step of establishing said publisher-subscriber rela- 
tionships includes causing said first filter module to 
maintain a subscriber list; 40 

upon receiving said message from said first source 
module, said first filter module determines whether said 
message satisfies a particular set of criteria; and 

if said message satisfies said particular set of criteria, then 
said first filter module sends a message to all modules 45 
listed in said subscriber list maintained for said filter 
module. 

4. The method of claim 3 wherein: 

said subscriber list maintained for said first filter module 

includes a first action module; and 
upon receiving said message from said first filter module, 

said first action module performs a particular action, 

5. llie method of claim 3 wherein: 

said configuration data includes a particular set of argu- 
ments that specify said particular set of criteria; and 

said step of initializing said loaded modules includes 
initializing said first filter module with said particular 
set of arguments to cause said first filler module to fUter 
based on said particular set of criteria. 60 

6. The method of claim 5 further comprising the steps of: 
after said step of initializing said set of loaded modules, 

receiving user input that specifies a second set of 
criteria that is different from said particular set of 
criteria; 

generating a second set of arguments that reflect said 
second set of criteria; and 



re-iniliaUzing said first filter module with said second set 
of arguments to cause said first filter module to filler 
based on said second set of criteria. 

7. Hie method of claim 1 wherein: 

said set of loaded modules includes a first filter module 
and a first action module; 

said siep of establishing said publisher-subscriber rela- 
tionships includes causing said first filler module to 
include said first action module in a subscriber list 
maintained for said first filter module; 

upon receiving a message from another loaded module, 
said first filter module determines whether said mes- 
sage satisfies a particular set of criteria; and 

if said message satisfies said particular set of criteria, then 
said first filter modide sends a message to all modules 
listed in said subscriber list maintained for said filter 
module. 

8. The method of claim 7 wherein: 

said configuration data includes a particular set of argu- 
ments that specify a particular action to be performed 
by said action module; and 

said step of iniliaUzing said loaded modules includes 
initializing said first action module with said particular 
set of arguments to cause said first action module to 
perform said particular action upon receipt of a mes- 
sage from said first filter module. 

9. The method of claim 8 wherein: 

after said step of initializing said set of loaded modules, 
receiving user input that specifies a second action that 
is different from said particular action; 

generating a second set of arguments that reflect said 
second action; and 

re-initializing said first action module with said second set 
of arguments to cause said first action module to 
perform said second action in response to messages 
from said first filter module. 

10. The method of claim 1 further comprising the steps of: 
after said set of source modules are executing, receiving 

input that specifies changes to said publisher-subscriber 
relationships between said loaded modules; and 
changing said publisher-subscriber relationships in 
response to said input. 

11. The method of claim 1 wherein: 

said loaded modules are objects that are instances of JAVA 
classes; 

the step of loading includes the step of searching a search 
path to locate code associated with said JAVA classes; 

and the step of causing said source modules to begin 
execution is performed by causing each of one or more 
source objects that belong to said loaded modules to 
begin execution in a separate thread. 

12. The method of claim 1 further comprising the step of 
executing a dispatcher system coordinator object in a thread 
to perform the steps of: 

reading said configuration data; 
loading and initializing said set of loaded modules; 
establishing said publisher-subscriber relationships; and 
causing said source modules to begin execution. 

13. A computer-readable medium carrying one or more 
sequences of instructions for filtering data, wherein execu- 
tion of the one or more sequences of instructions by one or 
more processors causes the one or more processors to 
perform the steps of: 

reading configuration data that specifies publisher- 
subscriber relationships between source modules in a 
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set of source modules, filter modules in a set of filter 
modules, and action modules in a set of action modules; 
wherein source modules in said set of source modules are 
software modules configured to obtain data trom a 
source and transmit the data in messages to a set ot 
subscribers; 

wherein the set of subscribers to which each source 
module transmits messages is determmed by informa- 
tion received by said source module while said source 
module is loaded into dynamic memory and not deter- 
mined by code in said source module; 
wherein filter modules in said set of filter modules arc 
software modules configured to receive messages and 
provide filtering criteria that decides whether the mes- 
sages should be dispatched to a set of subscribers; 
wherein the set of subscribers to which each filter module 
dispatches messages is determined by information 
received by said filter module whUe said filter module 
is loaded in dynamic memory and not determined by 
code in said filter module; 
wherein action modules in said set of action modules are 
software modules configured to respond to messages by 
performing actions; 
creating a set of loaded modules by loading, into dynamic 
memory, modules that belong to said set of source 
modules, said set of filler modules and said set of action 
modules; 

initializing said set of loaded modules; 
establishing said publisher-subscriber relationships 
between said set of loaded modules based on said 
configuration data; 
wherein the step of establishing publisher-subscriber rela- 
tionships includes • j , 
sending information, based on said configuration data, 
to each source module in said set of loaded modules 
to indicate to said source module the set of subscrib- 
ers to which said source module is to transmit 

messages; and ^ ■ a * 

sending information, based on said configuration data, 
to each filter module in said set of loaded modules to 
indicate to said filter module the set of subscribers to 
which said filter module is to dispatch messages. 
14. The computer-readable medium of claim 13 wherein: 
said set of loaded modules includes a first source module 

and a first filter module; 
said step of establishing said publisher-subscriber rela- 
tionships includes causing said first source module to 
include said first filter module in a subscriber list 
maintained for said first source module; 
when executing, said first source module receives data 

from one or more sources; and 
upon receiving data from said one or more sources, said 
first source module sends a message to all modules 
listed in said subscriber list maintained for said first 
source module. 
15. The computer-readable medium of claim 14 wherem: 
said step of establishing said publisher-subscriber rela- 
tionships includes causing said first filter module to 
maintain a subscriber list; 
upon receiving said message from said first source 
module, said first filter module determines whether said 
message satisfies a particular set of criteria; and 
if said message satisfies said particular set of criteria, then 
said first filter module sends a message to all modules 
listed in said subscriber list maintained for said filter 
module. 
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16. The computer-readable medium of claim 15 wherein: 
said configuration data includes a particular set of ar^- 

ments that specify said particular set of criteria; and 
said step of initializing said loaded objects includes 
initializing said first filter module with said particiilar 
set of arguments to cause said first filter module to filter 
based on said particular set of criteria. 

17. The computer-readable medium of claim 16 further 
comprising instructions for performing the steps of: 

after said step of initializing said set of loaded modules, 
receiving user input that specifies a second set of 
criteria thai is different from said particular set ot 
criteria; 

generating a second set of arguments that reflect said 

second set of criteria; and 
re-initializing said first filter module with said second set 
of arguments to cause said first filler module to filler 
based on said second set of criteria, 

18. The computer-readable medium of claim 13 wherein: 
said set of loaded modules includes a first filter module 

and a first action module; 
said step of establishing said publisher-subscriber rela- 
tionships includes causing said first filter module to 
include said first action module in a subscriber list 
maintained for said first filter module; 
upon receiving a message from another loaded module, 
said first filter module determines whether said mes- 
sage satisfies a particular set of criteria; and 
if said message satisfies said particular set of criteria, then 
said first filter module sends a message to all modules 
listed in said subscriber list maintained for said filter 
module. 

19. The computer-readable medium of claim 18 wherein: 
said configuration data includes a particular set of argu- 
ments that specify a particular action to be performed 
by said action module; and 
said step of initiaUzing said loaded objects includes 
initializing said first action module with said particular 
set of arguments to cause said first action module to 
perform said particular action upon receipt of a mes- 
sage from said first filter module; 
after said step of initializing said sel of loaded modules, 
receiving user input that specifies a second action that 
is different from said particular action; 
generating a second set of arguments that reflect said 

second action; and 
re-initializing said first action module with said second set 
of arguments to cause said first action module to 
perform said second action in response to messages 
from said first filter module. . u 

20. The computer-readable medium of claim 13 turther 
comprising instructions for performing the steps of: 

after said set of source modules are executing, receiving 
input that specifies changes to said publisher-subscriber 
relationships between said loaded modules; and 
changing said publisher-subscriber relationships in 
response to said input. 

21. The computer-readable medium of claim 13 wherein: 
said loaded modules are objects that are instances of JAVA 

classes; 

the step of loading includes the step of searching a search 
path to locate code associated with said JAVA classes; 
and the step of causing said source modules to begin 
execution is performed by causing each of one or more 
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source objects that belong to said loaded modules to 

begin execution in a separate thread. 
22. A system for filtering data comprising: 
a set of one or more source modules loaded and executing 

in memory; 

wherein source modules in said set of source modules are 
software modules configured lo obtain data from a 
source and transmit the data in messages to a set of 
subscribers; 

wherein the set of subscribers to which each source 
module transmits messages is determined by mforma- 
lion received by said source module while said source 
module is loaded into dynamic memory and not deter- 
mined by code in said source module; 

a set of one or more filter modules loaded in memory; 

wherein filter modules in said set of filter modules are 
software modules configured to receive messages and 
provide filtering criteria that decides whether the mes- 
sages should be dispatched to a set of subscribers; 

wherein the set of subscribers lo which each filter mod- 
uled dispatches messages is determined by mformalion 
received by said filter module when said filter module 
is executing and not determined by code m said filler 
module; 

a set of one or more action modules loaded in memory; 

wherein action modules in said set of action modules are 
software modules configured lo respond to messages by 
performing actions; 

said set of source modules including a first source module 
that receives data from a source and responds lo receipt 
of said data by transmitting messages to each sub- 
scriber in a first list of subscribers; 

said set of filter modules including a filter module that 
receives messages from a source module in said set ot 
source modules and responds to receipt of said mes- 
sages by 

determining whether said messages satisfy a set of crite- 
ria; and 

transmitting messages lo a second Usl of subscribers if 
said messages from said source module satisfy said set 
of criteria; 

said set of action modules including a first action module 
that receives messages from a filter module in said set 
of filter modules and responds to receipt of said mes- 
sages by performing a particular action; 

wherein members of said first list of subscribers are 
established when said first source module is loaded into 
said memory; and 

wherein members of said second list of subscribers are 
established when said firet filler module is loaded mto 

said memory. . . ♦ „ ss 

23 The system of claim 22 further comprising a system 
coordinator configured lo read configuration data that speci- 
fies 

said set of source modules, 

said set of filter modules, and 

said set of action modules; 
said system coordinator being further configured to load 

said set of source modules, 

said set of filler modules, and 

said set of action modules 
into said memory in response lo said configuration data. 



10 



15 



20 



25 



30 



35 



24 The system of claim 23 wherein: 
the configuration data further specifies publisher- 
subscriber relationships between source modules m 
said set of source modules, filter modules in said set ot 
filter modules, and action modules in said set of acUon 
modules; and 

the system coordinator is configured to establish members 
of said first list of subscribers and said second list ot 
subscribers in response to said configuration data. 

25 The system of claim 24 wherein said system coordi- 
nator changes members of at least one of said first subscrip- 
tion list and said second subscription Ust in response to input 
received after said set of source objects have begun execut- 
ing. 

26 The system of claim 22 further comprising a system 
coordinator configured to respond to particular user input by 
causing said first action module to change said particular 

action. . . , „ 

27 m system of claim 22 further compnsing a system 
coordinator configured to respond to particular user input by 
changing said set of criteria used by said first filter module. 

28 A system for filtering data comprising: 
a set of one or more source modules loaded and executing 

in memory; 

wherein said source modules are software modules con- 
figured to obtain data and transmit the data m messages 
to a set of subscribers; 
a set of one or more filter modules loaded in memory; 
wherein said filter modules are software modules config- 
ured to receive messages and provide filtering criteria 
that decides whether the messages should be dispatched 
to a set of subscribers; 
wherein one or more of the filtering criteria used by said 
filter modules is determined by information received by 
said filter modules when said filler modules are loaded 
into dynamic memory, and not delermmed by code m 
said filter modules; 
a set of one or more action modules loaded in memory; 
wherein said action modules are software modules con- 
figured to respond to messages by performmg actions; 
wherein one or more of said actions performed by said 
action modules in response to messages are determined 
by information received by said action modules when 
said action modules are loaded into dynamic memory, 
and not by determined code in said filler modules; 
said set of source modules including a first source module 
that receives data from a source and responds to receipt 
of said data by transmitting messages to each sub- 
scriber in a first list of subscribers; 
said set of filter modules including a filter module that 
receives messages from a source module in said set ot 
source modules and responds to receipt of said mes- 
sages by • f * f 
determining whether said messages satisfy a set ol 

criteria; and ^ ^ -u e 

transmitting messages to a second hst of subscribers if 
said messages from said source module satisfy said 
set of criteria; 

said set of action modules including a first action module 
that receives messages from a filter module m said set 
of filter modules and responds to receipt of said mes- 
sages by performing a particular action; 
wherein said set of criteria is established when said first 

filter module is loaded into said memory; and 
wherein said particular action is established when said 
first action module loaded into said memory. 
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29. Amethod for fiheriog data, the method comprising the 
steps of: 

receiving user input from a user that specifies 

relationships between source modules, filter modules ^ 

and action modules; and 
criteria to be used by said filler modules; 

wherein said source modules are software modules con- 
figured to obtain data and transmit the data m messages 
to a set of subscribers; 

wherein said filter modules are software modules config- 
ured to receive messages and provide filtering catena 
that decides whether the messages should be dispatched 
to a set of subscribers; 

wherein one or more of the filtering criteria used by said 35 
filler modules is determined by information received by 
said filter modules when said filter modules are loaded 
into dynamic memory, and not determined by code in 
said filler modules; 

wherein said action modules are software modules con- 20 
figured to respond to messages by performmg actions; 

based on said user input, loading and initializing a filter- 
ing system that includes 

filter modules that filler information from said source 

modules based on said criteria, and 
action modules that perform said actions in response to 
messages from said filter modules; and 
wherein the step of initiaUzing includes sending informa- 
tion to said filter modules after said filter modules are 
loaded, said information causing said filter modules to 
filter based on said criteria indicated in said user input. 
30 The method of claim 29 wherein said step of initial- 
izing includes initializing a first filter module with a par- 
ticular set of arguments to cause said first filter module to 
filter based on said particular set of criteria. 



of; 



25 



30 



31. The method of claim 30 further comprising the steps 

after said step of initializing, receiving user input that 
specifies a second set of criteria that is different from 
said particular set of criteria; 
generating a second set of arguments that reflect said 

second set of criteria; and 
re-initializing said fii^t filter module with said second set 
of arguments to cause said first fiher module to filler 
based on said second set of criteria. 

32. The method of claim 29 further comprising the steps 

of- .... 
after initializing said fiUering system, receiving user input 
that makes a modification to said relationships between 
said source modules, action modules and filter mod- 
ules; and 

whUe said fiUering system is in operation, modifymg said 
relationship between said source modules, action mod- 
ules and filler modules based on said user input. 

33 The method of claim 32 further comprising the step of 
generating a user interface through which a user can specify 
changes to said relationships. 

34 The method of claim 29 wherein one of said action 
modules causes a notification to be displayed to a user m 
response to receipt of a message from a filter. 

35 The method of claim 29 further comprising the step ot 
displaying a user interface for communicating to a user a set 
of parameter values that are currently in effect withm said 

fiUering system. • . r ^„ 

36 The method of claim 35 wherein said user interlace 
includes controls that allow a user to change said set of 
parameter values thai are currently in effect within said 
fiUering system. 
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